Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\ftp.exe
Modifies file system
Creates the following files
- %TEMP%\ixp000.tmp\hvfjqdjftvvpihelfuxnfgxcadwwgazbcqvoexdhiiiun.fencwzmbcgytmjxlsbvbjhqujucupiyq
- %TEMP%\ixp000.tmp\ufvkjdtpdgglotcqjwphmbmrhcjthpayuymqbxgxkup.maddnamunuwbtrehgzcaw
- %TEMP%\ixp000.tmp\qulfpyottebfhxhikifexfuvmipqjbjkh.srfsuzdzsacybtorwzwrakqfdeonls
- %TEMP%\ixp000.tmp\hwmxfqeefuodbimptxiisotfwbcdkg.bcebsxgnhaedxytpbnhf
- %TEMP%\ixp000.tmp\vninrjvwtjbalnpiqzopxal.bddiwmhgbilxgblfrvneoijlhxxgngowgvjmvoquyr
- %TEMP%\ixp000.tmp\svchost.com
- %TEMP%\ixp000.tmp\ka
- %TEMP%\dh0sb3ttczsr\c5jmn.tmp-shm
Deletes the following files
- %TEMP%\ixp000.tmp\ka
- %TEMP%\ixp000.tmp\qulfpyottebfhxhikifexfuvmipqjbjkh.srfsuzdzsacybtorwzwrakqfdeonls
- %TEMP%\ixp000.tmp\vninrjvwtjbalnpiqzopxal.bddiwmhgbilxgblfrvneoijlhxxgngowgvjmvoquyr
- %TEMP%\ixp000.tmp\hwmxfqeefuodbimptxiisotfwbcdkg.bcebsxgnhaedxytpbnhf
- %TEMP%\ixp000.tmp\ufvkjdtpdgglotcqjwphmbmrhcjthpayuymqbxgxkup.maddnamunuwbtrehgzcaw
- %TEMP%\ixp000.tmp\hvfjqdjftvvpihelfuxnfgxcadwwgazbcqvoexdhiiiun.fencwzmbcgytmjxlsbvbjhqujucupiyq
- %TEMP%\ixp000.tmp\svchost.com
- %TEMP%\dh0sb3ttczsr\c5jmn.tmp-shm
Network activity
UDP
- DNS ASK ht##N.htUIN
- DNS ASK fm########GEjlcR.fmEMNaHJySGEjlcR
Miscellaneous
Creates and executes the following
- '%TEMP%\ixp000.tmp\svchost.com' ka
- '%WINDIR%\syswow64\cmd.exe' /c cmd < HWmXFQeEFuOdbimpTXIISOtFWBCdkG.bCEBSxGNhaEDxYtPBNhF' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q %TEMP%\Dh0Sb3ttCzsr & timeout 2 & del /f /q "%WINDIR%\SysWOW64\ftp.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cmd < tivNBahuGkfZnXCDDyWmgCpPTpgnqDftuQ.JbqIMiWExzwXhRzWwzElBXHTstOueVlTIsSuDv' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c cmd < HWmXFQeEFuOdbimpTXIISOtFWBCdkG.bCEBSxGNhaEDxYtPBNhF
- '%WINDIR%\syswow64\cmd.exe'
- '%WINDIR%\syswow64\ping.exe' -n 1 htUIN.htUIN
- '%WINDIR%\syswow64\certutil.exe' -decode UFVKJdtpdgGLoTcqjWPhMbMrHcJtHPayUymQbxGxkup.MaDdNaMUNuwbTRehGZCAW ka
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 3
- '%WINDIR%\syswow64\ftp.exe'
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q %TEMP%\Dh0Sb3ttCzsr & timeout 2 & del /f /q "%WINDIR%\SysWOW64\ftp.exe"
- '%WINDIR%\syswow64\timeout.exe' 2
- '%WINDIR%\syswow64\cmd.exe' /c cmd < tivNBahuGkfZnXCDDyWmgCpPTpgnqDftuQ.JbqIMiWExzwXhRzWwzElBXHTstOueVlTIsSuDv
- '%WINDIR%\syswow64\ping.exe' -n 1 DuqYAYUt.DuqYAYUt
- '%WINDIR%\syswow64\certutil.exe' -decode dTiuhMGXxbGrTyPfEaVSNiuANPcsWAuTgx.pRMcRvaXQRWVHiQtrJIKpNGzns Ta
